A stored XSS flaw resides in the YouTube Video "value" field of the Ultimate Member WordPress plugin. When an authenticated user with Subscriber-level access or higher edits the field to contain a malicious script, the input is saved without proper sanitization or escaping. Any user who views that profile page receives the injected script in their browser, enabling attackers to steal session cookies, deface content, or perform phishing attacks directly from the profile view.

The vulnerability affects the Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress. All releases up to and including version 2.11.0 are impacted. Users running these plugin versions on any WordPress site are susceptible, regardless of WordPress core version.

The CVSS base score of 6.4 indicates moderate severity, while the EPSS score of less than 1% shows the likelihood of exploitation is very low at the time of analysis. The flaw is not catalogued in the CISA KEV list. Exploitation requires an authenticated session with at least Subscriber privileges and interaction with the profile editing interface. Once the malicious input is stored, it propagates to any visitor of the profile page, making the attack vector internal but lateral to other users’ browsers.